Techniques › T1547 › T1547.006
T1547.006 Kernel Modules and Extensions
persistence · privilege escalation — macOS, Linux · attack.mitre.org · JSON
1
MITRE detection strategy
2
analytics
2
Sigma rules tagged attack.t1547.006
0
KEV CVEs mapped here
<p>Adversaries may modify the kernel to automatically execute programs on system boot. Loadable Kernel Modules (LKMs) are pieces of code that can be loaded and unloaded into the kernel upon demand. They extend the functionality of the kernel without the need to reboot the system. For example, one type of module is the device driver, which allows the kernel to access hardware connected to the system.</p><p>When used maliciously, LKMs can be a type of kernel-mode Rootkit that run with the highest operating system privilege (Ring 0). Common features of LKM based rootkits include: hiding itself, selective hiding of files, processes and network activity, as well as log tampering, providing authenticated backdoors, and enabling root access to non-privileged users.</p><p>Kernel extensions, also called kext, are used in macOS to load functionality onto a system similar to LKMs for Linux. Since the kernel is responsible for enforcing security and the kernel extensions run as apart of the kernel, kexts are not governed by macOS security policies. Kexts are loaded and unloaded through <code>kextload</code> and <code>kextunload</code> commands. Kexts need to be signed with a developer ID that is granted privileges by Apple allowing it to sign Kernel extensions. Developers without these privileges may still sign kexts but they will not load unless SIP is disabled. If SIP is enabled, the kext signature is verified before being added to the AuxKC.</p><p>Since macOS Catalina 10.15, kernel extensions have been deprecated in favor of System Extensions. However, kexts are still allowed as "Legacy System Extensions" since there is no System Extension for Kernel Programming Interfaces.</p><p>Adversaries can use LKMs and kexts to conduct Persistence and/or Privilege Escalation on a system. Examples have been found in the wild, and there are some relevant open source projects as well.</p>
KEV CVEs mapped to this technique · CTID Mappings Explorer
None. No KEV entry in the public mapping names this technique. Given that 74.7% of KEV has no mapping at all, this says more about the mapping than about the technique.
Detection strategy · ATT&CK Enterprise v19.2
- DET0450 Detection Strategy for Kernel Modules and Extensions Autostart Execution v1.0
AN1243 LinuxMonitor kernel module load/unload activity via modprobe, insmod, rmmod, or direct manipulation of /lib/modules. Correlate with installation of kernel headers, compilation commands, or downloads of .ko files. Detect anomalies in unsigned module loading or repeated module load attempts under non-root users.auditd:SYSCALL
Execution of insmod, modprobe, or rmmod commands by non-standard users or outside expected timeframes→ DC0064 Command Executionauditd:SYSCALLAccess or modification to /lib/modules or creation of .ko files→ DC0039 File Creationlinux:osqueryNew or modified kernel object files (.ko) within /lib/modules directory→ DC0061 File ModificationTunable:UserContextTimeWindowFilePathRegexAN1244 macOSDetect user-initiated kextload commands or modifications to /Library/Extensions. Correlate with changes to KextPolicy database or unauthorized developer signing identities. Alert on attempts to disable SIP or load legacy extensions from unsigned sources.macos:osqueryProcesses executing kextload, spctl, or modifying kernel extension directories→ DC0032 Process Creationmacos:osqueryNew kext entries not signed by Apple or outside standard identifier prefix→ DC0031 Kernel Module Loadmacos:osqueryModifications to /var/db/SystemPolicyConfiguration/KextPolicy or kext_policy table→ DC0061 File ModificationTunable:DeveloperIDAllowlistKextLoadTimeWindowSignatureCheckFlag
Sigma rules · SigmaHQ da9bb07d64, tag attack.t1547.006
Author: Pawel Mazur
· 2021-11-02 (modified 2022-12-25) · logsource: product=linux service=auditd · 106d7cbd-80ff-4985-b682-a7043e5acb72
Detects loading of kernel modules with insmod command.
Loadable Kernel Modules (LKMs) are pieces of code that can be loaded and unloaded into the kernel upon demand.
Adversaries may use LKMs to obtain persistence within the system or elevate the privileges.
Author: Gene Kazimiarovich
· 2026-05-09 · logsource: product=linux category=process_creation · 474b415a-d917-4f3b-8c62-9e1a0d5f7b48
Detects kernel auto-loading of the authencesn crypto module via modprobe
This occurs when user-space code creates an AF_ALG socket and binds the authencesn AEAD cipher
(e.g., authencesn(hmac(sha256),cbc(aes))). The kernel invokes modprobe to load the
crypto module. This is a key indicator of CVE-2026-31431 (Copy Fail) exploitation,
where the authencesn cipher is used to trigger a buffer overflow in the AF_ALG AEAD splice path,
corrupting the page cache of SUID binaries for local privilege escalation.
On Linux systems, modprobe is typically a symlink to kmod, so the process image will be /usr/bin/kmod (or /bin/kmod)
with 'modprobe' appearing in the command line.
Rules tagged at the parent level (attack.t1547) 7
These target the parent technique, not this sub-technique specifically. Listed for completeness, not counted as coverage.
Author: Elastic, Josh Nickels, Marius Rothenbücher
· 2024-09-06 · logsource: product=windows service=security · 123e4e6d-b123-48f8-b261-7214938acaf0
Detects the modification of Group Policy Objects (GPO) to add a startup/logon script to users or computer objects.
Author: frack113
· 2021-11-18 (modified 2022-12-06) · logsource: product=windows category=registry_event · 277efb8f-60be-4f10-b4d3-037802f37167
Detects persistence registry keys for Recycle Bin
Author: Mateusz Wydra, oscd.community
· 2020-10-13 (modified 2023-01-19) · logsource: product=windows category=registry_event · 9577edbb-851f-4243-8c91-1d5b50c1a39b
Detects creation/modification of Assistive Technology applications and persistence with usage of 'at'
Author: Hai Vaknin @LuxNoBulIshit, Avihay eldad @aloneliassaf, Austin Songer @austinsonger
· 2021-09-30 (modified 2022-10-09) · logsource: product=windows category=process_creation · a2ea3ae7-d3d0-40a0-a55c-25a45c87cac1
Detects when a possible suspicious driver is being installed via pnputil.exe lolbin
Author: Greg (rule)
· 2022-07-21 (modified 2023-01-05) · logsource: product=windows category=file_event · a6976974-ea6f-4e97-818e-ea08625c52cb
Detects a phishing attack which expands a ZIP file containing a malicious shortcut.
If the victim expands the ZIP file via the explorer process, then the explorer process expands the malicious ZIP file and drops a malicious shortcut redirected to a backdoor into the Startup folder.
Additionally, the file name of the malicious shortcut in Startup folder contains {0AFACED1-E828-11D1-9187-B532F1E9575D} meaning the folder shortcut operation.
Author: omkar72
· 2020-10-30 (modified 2021-11-27) · logsource: product=windows category=registry_event · b98968aa-dbc0-4a9c-ac35-108363cbf8d5
Detects potential malicious modification of run keys by winekey or team9 backdoor
Author: Florian Roth (Nextron Systems)
· 2022-05-19 · logsource: product=windows category=process_creation · f14e169e-9978-4c69-acb3-1cff8200bc36
Detects the suspicious execution of a utility to convert Windows 3.x .grp files or for persistence purposes by malicious software or actors